LogQL Queries for Grafana Loki That Earn Their Keep

Loki's LogQL looks like PromQL because it borrows the label model — once that clicks, most queries write themselves.

Filter logs from one service, drop health checks

{app="checkout"} |= "error" != "/healthz"

Parse JSON logs and filter on a field

{app="checkout"} | json | status_code >= 500

Error rate over time (for an alert or panel)

sum(rate({app="checkout"} |= "error" [5m]))

Extract and count by a label pulled from unstructured text

{app="nginx"} | regexp `status=(?P<status>\d+)` | status = "502"

Top 10 slowest requests from JSON logs

topk(10,
  {app="checkout"} | json | unwrap duration_ms | __error__=""
)

Compare error volume this hour vs. same hour yesterday

sum(count_over_time({app="checkout"} |= "error" [1h]))
  /
sum(count_over_time({app="checkout"} |= "error" [1h] offset 1d))

Query straight from the CLI with logcli

logcli query '{app="checkout"} |= "error"' --since=1h --limit=200

| json plus unwrap is the combination that turns Loki from "grep with labels" into something you can actually build alerting math on top of.